CVE-2026-118597
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a cr
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-79
Sin historial EPSS suficiente todavía.
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.
- fluidattacks.comhttps://fluidattacks.com/advisories/rhiannon
- github.comhttps://github.com/akaunting/akaunting
- github.comhttps://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php
- github.comhttps://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php
- github.comhttps://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-923795.4 MED—
———An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.6hCVE-2026-815575.4 MED—
———An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.6hCVE-2026-136565.4 MED—
———An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.6hCVE-2026-1257856.5 MED—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.9hCVE-2026-1268105.4 MED—
———WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.13hCVE-2026-1268068.7 ALT—
———WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.13h